I can’t do all your recommendations but from now when you save an automation using this script and attach_csv is checked, it will generate an error if csv is not in the list of authorized_extensions:
https://github.com/discourse/discourse-data-explorer/pull/346
Thanks for the report.